Conversions API (CAPI): How to Recover 20-40% of Lost Attribution After iOS 14

When Apple released iOS 14.5 in April 2021 with App Tracking Transparency (ATT), it broke the Meta pixel for an estimated 70-85% of iPhone users who opted out of tracking. Overnight, advertisers saw reported conversions drop by 20-40% and CPA figures skyrocket — not because campaigns got worse, but because the pixel could no longer see most of the conversions happening. The fix is Conversions API (CAPI), a server-side tracking method that bypasses browser restrictions entirely. Most accounts either haven't set it up or set it up incorrectly, leaving real ROAS hidden. Here's the complete implementation guide.

What Conversions API Actually Is

Conversions API is a direct server-to-server connection between your website (or backend system) and Meta's ad platform. Instead of relying on a JavaScript pixel running in the user's browser — which can be blocked by iOS, ad blockers, privacy extensions, or ATT opt-outs — CAPI sends conversion events directly from your server to Meta's API. No browser, no cookies, no ATT dependency.

The practical effect: every purchase, lead, or conversion event fires reliably regardless of the user's privacy settings, browser choice, or device. Meta's algorithm gets a complete picture of which ads actually drove conversions, not just the subset visible through the pixel.

Pixel vs CAPI: The Core Difference

The Meta Pixel is a JavaScript snippet that lives on your website. When a user hits a page, the script runs in their browser and fires an event to Meta. If the user has ATT opt-out, Safari's Intelligent Tracking Prevention, a VPN, or an ad blocker, this event either doesn't fire at all or fires with degraded data.

CAPI is a server-side webhook. When a user completes a purchase on your website, your server (not the browser) sends a direct API call to Meta with the event data. The user's device never touches the call, so browser-level privacy settings can't block it.

You're not supposed to pick one or the other — you're supposed to run both in parallel. Meta's algorithm uses deduplication to match events coming from both sources and count them once. This gives you the most complete tracking possible while maintaining redundancy if one system fails.

"We implemented CAPI correctly on a client account that had been running Pixel-only for 18 months. In the first 30 days after CAPI went live, reported conversions in Meta Ads Manager increased by 34%. The ads were performing that well the whole time — we just couldn't see it because iOS users were invisible."

Why 80% of CAPI Implementations Are Wrong

Most agencies and developers install CAPI using one of the "easy" integrations (Shopify's native CAPI connection, WooCommerce plugins, GTM server-side container) and consider the job done. These integrations work, but they usually miss the things that actually make CAPI effective. Here are the four most common failure modes.

1. Missing or Low-Quality User Data Parameters

CAPI's power comes from sending rich user data parameters alongside each event — hashed email, phone number, IP address, user agent, Facebook click ID (fbc), and Facebook browser ID (fbp). These parameters are how Meta matches the server-side event back to a specific user in its ad auction system.

If you only send the event (e.g., "Purchase $120") without user data, Meta has no way to attribute that purchase to a specific ad click. It sees the event but can't credit it. Events like this show up in the API dashboard but don't improve attribution at all.

Fix: Every CAPI event must include at minimum: hashed email, hashed phone, IP address, user agent, fbc (from the _fbc cookie), and fbp (from the _fbp cookie). More parameters = higher match rate = better attribution.

2. Event Match Quality Below 7

Meta grades your CAPI implementation with an Event Match Quality (EMQ) score from 0-10 for each event. The score reflects how well your events match to real Meta users. A score below 7 means your events aren't being used effectively in the ad auction, and you're getting almost none of the benefit of CAPI.

You can check EMQ in Events Manager → Data Sources → your pixel → "Diagnostics" tab. If any event type is below 7, you need to add more user data parameters until the score climbs to 8+.

3. Missing Deduplication Configuration

When both Pixel and CAPI fire the same event for the same user, Meta needs to know they're the same event so it doesn't double-count. Deduplication requires sending a unique event_id with both the Pixel event and the CAPI event, and they must match.

If deduplication isn't configured, your reported conversions will double or triple because Meta counts the Pixel event and the CAPI event separately. Your ROAS will look amazing in the dashboard but your bank account won't agree.

Fix: Generate a UUID at the server when the event fires. Pass it to the frontend Pixel event as the eventID parameter, and also include it in the CAPI request as event_id. Meta matches them automatically.

4. Sending Events With Delays Over 60 Minutes

CAPI events must be sent to Meta within a reasonable time window for attribution to work. If your system batches events and sends them hourly, nightly, or on a delay, Meta often can't match them back to the ad click that drove them. The attribution window has passed.

Fix: CAPI events should be sent within 1-5 minutes of the conversion happening. For ecommerce, fire at the exact moment of the purchase confirmation. For lead gen, fire at the moment of form submission. Don't batch, don't queue — send immediately.

The Complete CAPI Implementation Checklist

Here's the exact sequence to implement CAPI correctly from scratch. Works for any platform, any stack.

Step 1: Decide Your Integration Method

You have three options, in order of preference:

• Direct server-side integration — Your backend code sends events directly to Meta's Graph API. Best performance, highest control, requires developer time.
• Conversions API Gateway (CAPIG) — Meta's hosted middleware that handles the API calls for you. Good middle ground for non-dev teams.
• Platform integrations — Shopify, WooCommerce, Webflow, etc. native CAPI connections. Easiest to set up, lowest quality by default (but can be improved with custom parameters).

Step 2: Create a Dataset in Events Manager

Go to Events Manager → Connect Data Sources → Web. Create a new pixel/dataset or use your existing one. Save the pixel ID — you'll need it for the CAPI requests.

Step 3: Generate an Access Token

In the same Events Manager area, click "Set up" next to Conversions API. Meta will generate an access token specifically for CAPI. Copy this and store it as an environment variable on your server. Never commit it to code — it can be used to send fake events to your account if leaked.

Step 4: Set Up Event Deduplication IDs

On your website frontend, when an event happens (e.g., purchase), generate a UUID in JavaScript. Pass it to the Pixel event:

fbq('track', 'Purchase', { value: 120.00, currency: 'USD' }, { eventID: 'generated-uuid-123' });

Simultaneously, your backend sends the same UUID as event_id in the CAPI request. Meta matches them and deduplicates.

Step 5: Collect and Hash User Data

Before sending the CAPI request, collect as much user data as possible from the checkout/form:

• Email address → SHA-256 hash (lowercase, trimmed)
• Phone number → SHA-256 hash (E.164 format, digits only)
• First name, last name → SHA-256 hash (lowercase)
• City, state, zip → SHA-256 hash
• IP address → plaintext (Meta hashes it server-side)
• User agent → plaintext
• fbc cookie value → plaintext (format: fb.1.timestamp.fbclid)
• fbp cookie value → plaintext (format: fb.1.timestamp.randomnumber)

Meta hashes everything except IP, user agent, fbc, and fbp. You must hash the user data before sending it — sending plaintext PII is a policy violation and Meta will reject the events.

Step 6: Send the Event via API

Make a POST request to:

https://graph.facebook.com/v19.0/{PIXEL_ID}/events?access_token={ACCESS_TOKEN}

The request body is a JSON object with an data array containing one or more events. Each event has event_name, event_time (Unix timestamp), event_id (for dedup), user_data (hashed params), and custom_data (value, currency, content IDs, etc.).

Step 7: Verify in Events Manager

Within 5-10 minutes, the event should appear in Events Manager → Test Events (if you passed a test_event_code) or the main Overview tab. Check the Event Match Quality score immediately. If it's below 7, add more user data parameters and retest.

Step 8: Validate Deduplication

In Events Manager → Diagnostics, look for the "Event deduplication" diagnostic. It should show that 70-90% of your events are being successfully deduplicated between Pixel and CAPI. If the number is low, your event_id matching isn't working.

Pre-Built Integrations Worth Using

If direct server-side integration isn't feasible, these are the platform integrations that work best with minimal customization.

Shopify

Shopify's native Facebook channel now includes CAPI by default. It handles deduplication automatically and sends all standard ecommerce events (ViewContent, AddToCart, Purchase). The main weakness is limited user data parameters — you'll want to enhance it with a tool like Elevar or Stape for advanced parameter mapping.

WooCommerce

The Facebook for WooCommerce plugin supports CAPI out of the box. Works well, but like Shopify, sends minimal user data. Enhance with PixelYourSite Pro or a custom server-side implementation for better EMQ.

Google Tag Manager Server-Side

GTM server-side gives you a middle path: you still use GTM (familiar to marketers), but events are routed through a server container that can strip PII, add parameters, and send server-side to Meta. Costs $30-120/month depending on volume.

Stape.io and Addingwell

Hosted CAPI gateways that handle all the server-side infrastructure for you. Good for teams that can't run their own server code. Typically $20-100/month.

Common Setup Errors and How to Diagnose Them

Error: "Events received but not attributed"

Your events are reaching Meta but not being credited to ad clicks. Cause: missing fbc and fbp parameters. These are the cookies Meta uses to trace an event back to the ad click. Make sure your backend is reading both cookies on the frontend and passing them through to the CAPI request.

Error: "Event Match Quality: Fair (below 7)"

Events are firing but user data quality is too low to match to users. Cause: not enough user data parameters. Add hashed first name, last name, city, state, and zip if available. Each parameter added usually bumps EMQ by 0.3-0.5.

Error: "Events being double-counted"

Deduplication isn't working. Cause: event_id mismatch between Pixel and CAPI. Check that your frontend Pixel call and backend CAPI call are passing the exact same UUID. Any character difference breaks dedup.

Error: "Events rejected: PII not hashed"

You're sending raw email/phone instead of SHA-256 hashes. Meta rejects unhashed PII at the API level. Fix: hash everything before sending, using SHA-256 with lowercase trimmed input.

Error: "Events show up 30+ minutes late"

You're batching events before sending. Fix: send each event individually, immediately at the moment it happens. Never queue CAPI events for later delivery.

What to Expect After Proper Implementation

Once CAPI is correctly set up with high EMQ, deduplication, and fast event delivery, you'll see these changes in Ads Manager within 2-4 weeks:

• Reported conversions increase by 15-40% — the previously invisible iOS and ad-blocker conversions start showing up
• Reported CPA drops proportionally — same spend, more visible conversions
• ROAS figures align with actual bank account data — no more mysterious gap between "Meta says $X" and "Stripe says $Y"
• Learning phases exit faster — more conversion data per adset means the 50-event threshold is hit sooner
• Algorithm optimization improves — with richer data, Meta finds high-converting users more accurately

The Bottom Line

If you're running Meta ads in 2026 without a properly-configured Conversions API, you're flying blind on 20-40% of your actual performance. Reported CPA looks worse than reality, ROAS looks lower, and the algorithm has incomplete data to optimize from. Every one of these problems compounds over time.

The good news: CAPI is a one-time setup. Once it's running correctly with EMQ above 8, deduplication enabled, and events firing within minutes, you're done. The infrastructure runs itself and your ad performance reporting finally matches reality. Every serious Meta advertiser should be running CAPI. Check your Events Manager right now — if you're not seeing a "Server" badge next to your events, this is your next priority.